# 産業・医療向け20件の告知：機器別の更新と、修正待ちの対応

- ID: JVNVU98747108
- 製品: CISA ICS Advisory / ICS Medical Advisory（2026年10月22日）
- 重要度: 未評価
- CVSS: 不明
- 悪用状況: 未確認（悪用がないことを意味しません）
- 公開日時: 2026-10-23T02:00:00.000Z
- 情報源の更新日時: 2026-10-23T02:00:00.000Z
- このサイトの取得日時: 2026-10-23T03:17:49.705Z

## 概要
カメラ・映像配信装置、Siemensの制御・管理製品、医療向けIRIS for Healthの告知です。製品名と版を照合し、下の同じ製品の更新先だけを使ってください。サーバー側で対応済みのMeariと、機器更新が必要な製品、修正待ちの製品を分けています。

## どんな危険？
製品ごとに、管理情報を見られる、不正な処理を動かされる、機器や通信が止まるなどの問題があります。例えばWinCCはデータベースへの認証済みアクセス、S7のWebサーバーは権限のある利用者のブラウザー操作、IRISは暗号化せず通信できる設定が関係します。同じ危険が20件すべてに当てはまるわけではありません。

## 対象バージョン
不明。情報源で製品・バージョン・設定条件を確認してください。

## 修正版
不明。修正版がないことを意味しません。

## 対策
1. Meariはサーバー修正の適用済み状況を確認し、CloudEdgeをApp StoreまたはGoogle Playの最新アプリへ更新します。Kiloview E3はV1.30、App Publisherは1.27.9、Software Centerは4.0.9.8以降へ更新します。Software Centerは次回起動時に自動更新されるとされています。
2. Capital AR Classic R20-11は2303以降へ、SENTRONは5.2以降へ、PSS SINCAL V22.5はUpdate 5以降へ更新します。Capital 431-422は修正予定なし、SINCAL V21.5/V22.0は修正版未提供のため、それぞれ移行方針を提供元と決めてください。
3. IPCのBIOSは、BX-21Aが31.01.13以降、RW-543Aが1.1.4以降、IPC227G・277G・277G PRO・327G・377Gが28.01.15以降へ更新します。別型番用のBIOSを流用しません。更新後はBIOSの既定設定を読み込みます。Secure Boot鍵を既に登録していた場合は、その後に鍵を登録し直す必要があります。担当者が現在の起動設定と鍵の復元手順を確認して実施してください。
4. PXC CompactはBACnet 3.5.7以降、P2 2.8.21以降へ更新します。APOGEEのMBC/MEC PPC BACnet/P2は修正予定なしです。ほかのAPOGEE/TALON/Desigo型番も同じ番号と判断せず、機器の完全な型番を保守担当者へ渡して対応を依頼してください。
5. Device Kitは該当系列の1.26.2-1、1.27.1-1、1.28.0-6以降へ更新します。旧系列には修正予定なしの区分があります。機器に組み込まれたKitは開発用Kitだけ更新しても機器へ反映されないため、機器メーカーの更新を確認します。.NET Client Libraryは3.3.61と3.3.62の両修正が入った版を利用します。
6. RUGGEDCOM CROSSBOWとCROSSBOW SACは、それぞれ製品の6.0以降へ更新します。内蔵ライブラリーの修正番号を機器ファームウェアの番号として使わないでください。
7. WinCC V8.0はUpdate 11以降、V8.1はUpdate 7以降へ更新します。V7.5はこの告知時点で修正版がないため、提供元と移行・接続制限を検討してください。
8. Industrial Edge Devicesは型番に合わせ、IECD・IEOD・IEVDを1.28.1以降、IOT2050 Advanced/SM・BX-21Aを1.28.1-2以降、BX-39A・BX-59A・IPC127Eを3.2.0-17以降へ更新します。SCALANCEやHMIの修正待ち区分へ、これらの更新を流用しません。
9. Nozomi Guardian/CMC搭載APE1808は、Siemensの顧客サポートへパッチと更新情報を依頼します。CPU 1518 V3.1.7、TM MFP V1.1.1、S7 Webサーバーの告知には、この公表時点で修正版未提供の区分があります。
10. IRIS for Healthは担当者がIRIS superserverのTLS設定を「Required」にします。「Enabled」は暗号化しない接続も許可するため、TLS必須化の代わりにはなりません。接続するアプリ側もTLSで接続できることを確認します。
11. 対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。

## 日本語ガイダンスの確認状況
- 形式: 1.0
- 作成方法: reviewed
- 確認状態: current
- 個別解説の確認日時: 2026-10-23T03:49:22.000Z
- fact/fix は公表された条件・対策の説明、check は利用環境で確かめる項目、procedure は一般的な作業手順です。利用者の環境を診断した結果ではありません。
- 個別解説と照合した入力本文の識別値: reviewed-source-v1:31854b7eb0f60c3cc4a4760c467e73f74271ae4d069d68f8d2f46162bee87b33
- 個別解説の照合対象: official\_evidence
- 概要の根拠となる抜粋ID: E1, E2, E3, E65, E5, E52, E7, E53, E9, E10, E11, E12, E14, E15, E55, E17, E19, E20, E56, E23, E58, E25, E60, E29, E31, E35, E37, E38, E32, E34, E27, E61, E39, E64, E43, E62, E44, E66
- リスクの根拠となる抜粋ID: E1, E2, E3, E65, E5, E52, E7, E53, E9, E10, E11, E12, E14, E15, E55, E17, E19, E20, E56, E23, E58, E25, E60, E29, E31, E35, E37, E38, E32, E34, E27, E61, E39, E64, E43, E62, E44, E66

## 自分は対象？
1. Meari IoT Cloud Platform OpenAPI Serviceは、設定やdevice shadowデータを権限なく操作できる2件の問題です。サーバー側の修正は全利用者に適用済みと公表され、CloudEdgeアプリは必須の更新が案内されています。 (公表された条件)
   - 対応する原文の抜粋ID: E1, E2
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06
2. Kiloview E3 NDI Encoderはfirmware 1.30より前、Industrial Edge App Publisherは1.27.9より前、Siemens Software Centerは4.0.9.8より前です。App Publisherでは通信相手の偽装を経由した不正な処理、Software Centerではログイン済みのローカル利用者が置いたDLLの読み込みが問題です。 (公表された条件)
   - 対応する原文の抜粋ID: E3, E4, E5, E6, E7, E8
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
3. Capital Embedded AR Classicは431-422の全版、およびR20-11の2303より前です。SENTRON 3NA COM Fuseは5.2より前です。PSS SINCALは旧WibuKeyドングルのライセンス機構を使う場合で、V21.5・V22.0の全版とV22.5 Update 5より前が対象です。いずれも主な影響として停止が示されています。 (公表された条件)
   - 対応する原文の抜粋ID: E9, E10, E11, E12, E13, E14
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-05
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
4. Secure Bootのテスト鍵に関する対象は、SIMATIC IPC BX-21AのBIOS 31.01.13より前、RW-543Aの1.1.4より前、IPC227G・IPC277G・IPC277G PRO・IPC327G・IPC377Gの28.01.15より前です。 (公表された条件)
   - 対応する原文の抜粋ID: E15, E16
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07
5. APOGEE・TALON・Desigoの一部機種には、BACnet通信などによる停止の問題があります。MBC/MEC PPCのBACnet/P2製品は全版、PXC CompactはBACnet 3.5.7より前・P2 2.8.21より前など、型番と通信方式で範囲が異なります。 (公表された条件)
   - 対応する原文の抜粋ID: E17, E18, E19
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
6. Industrial Edge Device Kitでは、ログイン済み利用者が意図しない場所の情報を読めます。旧V1.5〜V1.25系列と、V1.26の1.26.2-1より前、V1.27の1.27.1-1より前、V1.28の1.28.0-6より前などが対象です。arm64/x86-64の区分も確認します。 (公表された条件)
   - 対応する原文の抜粋ID: E20, E21, E22
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
7. .NET Client Library for S7 Webserver APIは、CVE-2026-85114が3.3.61より前、CVE-2026-85115が3.3.62より前です。秘密情報の扱いとダウンロード先へのファイル書き込みに関する問題です。 (公表された条件)
   - 対応する原文の抜粋ID: E23, E24
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
8. SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFPはV3.1.7のGNU/Linux subsystem、SIMATIC S7-1500 TM MFPはV1.1.1のGNU/Linux subsystemが対象です。PLC全体のどの処理にも同じ影響があるという意味ではありません。 (公表された条件)
   - 対応する原文の抜粋ID: E25, E26, E27, E28
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16
9. RUGGEDCOM CROSSBOWとRUGGEDCOM CROSSBOW SACは6.0より前です。前者にはSQL命令・管理認証情報・権限・設定による停止など、後者には内蔵SQLiteに関係するコード実行・情報・停止の問題があります。 (公表された条件)
   - 対応する原文の抜粋ID: E29, E30, E31, E32, E33, E34
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15
10. WinCCの問題は、対象システムのデータベースにログインできる攻撃者が、ホスト上で不正な命令を実行できるものです。WinCC V7.5全版、V8.0 Update 11より前、V8.1 Update 7より前が対象です。 (公表された条件)
   - 対応する原文の抜粋ID: E35, E36, E37
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13
11. SIMATIC/SIPLUS S7のWebサーバーは、告知に列挙されたDrive Controller・ET200・S7-1200/1500などのモデルが対象です。権限のある利用者のブラウザーで不正なスクリプトが動くと、その利用者に許された範囲でPLC操作ができる問題です。利用者の権限を無条件で超えられるという公表ではありません。 (公表された条件)
   - 対応する原文の抜粋ID: E38
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14
12. Industrial Edge Devicesの認証済み利用者による情報取得は、IECD・IEOD・IEVDの1.28.1より前、IOT2050 Advanced/SMとBX-21Aの1.28.1-2より前、BX-39A・BX-59A・IPC127Eの3.2.0-17より前などが対象です。SCALANCE LPE9413/LPE9433や一部HMI製品には修正版未提供の区分があります。 (公表された条件)
   - 対応する原文の抜粋ID: E39, E40, E41, E42
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
13. RUGGEDCOM APE1808はNozomi Guardian/CMCを載せた構成が対象です。細工したダッシュボードの利用・取り込み、監視対象への接続のなりすまし、制限された認証情報管理や設定の操作など、問題ごとに条件が異なります。 (公表された条件)
   - 対応する原文の抜粋ID: E43
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18
14. InterSystems IRIS for Healthの掲載版は2026.2.0.221、2026.1.0.235、2025.3.0.226です。既定でTLSを必須にしないため、通信中のデータやログイン情報が露出する可能性があります。 (公表された条件)
   - 対応する原文の抜粋ID: E44, E45
   - 根拠: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
15. 利用中の製品名・型番・完全な版番号を確認し、自分の製品の項目だけを照合してください。複数製品をまとめた告知では、別製品の修正版や対策を流用しません。分からない項目は管理担当者にこのページを渡して確認します。 (自分の環境で確認)
   - 対応する原文の抜粋ID: E46, E47, E48, E49, E50
   - 根拠: https://jvn.jp/vu/JVNVU98747108/
16. 最初に「CISA ICS Advisory / ICS Medical Advisory（2026年10月22日）」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。 (自分の環境で確認)
   - 根拠: https://jvn.jp/vu/JVNVU98747108/

## 使っているバージョンの調べ方
1. 「CISA ICS Advisory / ICS Medical Advisory（2026年10月22日）」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。 (一般的な作業手順)
   - 根拠: https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf
   - 根拠: https://jvn.jp/vu/JVNVU98747108/

## 具体的な対策
1. Meariはサーバー修正の適用済み状況を確認し、CloudEdgeをApp StoreまたはGoogle Playの最新アプリへ更新します。Kiloview E3はV1.30、App Publisherは1.27.9、Software Centerは4.0.9.8以降へ更新します。Software Centerは次回起動時に自動更新されるとされています。 (公表された対策)
   - 対応する原文の抜粋ID: E1, E2, E3, E51, E5, E6, E52, E7, E8, E53
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
2. Capital AR Classic R20-11は2303以降へ、SENTRONは5.2以降へ、PSS SINCAL V22.5はUpdate 5以降へ更新します。Capital 431-422は修正予定なし、SINCAL V21.5/V22.0は修正版未提供のため、それぞれ移行方針を提供元と決めてください。 (公表された対策)
   - 対応する原文の抜粋ID: E9, E10, E11, E12, E54, E14
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-05
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
3. IPCのBIOSは、BX-21Aが31.01.13以降、RW-543Aが1.1.4以降、IPC227G・277G・277G PRO・327G・377Gが28.01.15以降へ更新します。別型番用のBIOSを流用しません。更新後はBIOSの既定設定を読み込みます。Secure Boot鍵を既に登録していた場合は、その後に鍵を登録し直す必要があります。担当者が現在の起動設定と鍵の復元手順を確認して実施してください。 (公表された対策)
   - 対応する原文の抜粋ID: E15, E16, E55
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07
4. PXC CompactはBACnet 3.5.7以降、P2 2.8.21以降へ更新します。APOGEEのMBC/MEC PPC BACnet/P2は修正予定なしです。ほかのAPOGEE/TALON/Desigo型番も同じ番号と判断せず、機器の完全な型番を保守担当者へ渡して対応を依頼してください。 (公表された対策)
   - 対応する原文の抜粋ID: E17, E18, E19
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
5. Device Kitは該当系列の1.26.2-1、1.27.1-1、1.28.0-6以降へ更新します。旧系列には修正予定なしの区分があります。機器に組み込まれたKitは開発用Kitだけ更新しても機器へ反映されないため、機器メーカーの更新を確認します。.NET Client Libraryは3.3.61と3.3.62の両修正が入った版を利用します。 (公表された対策)
   - 対応する原文の抜粋ID: E20, E56, E22, E23, E57, E58
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
6. RUGGEDCOM CROSSBOWとCROSSBOW SACは、それぞれ製品の6.0以降へ更新します。内蔵ライブラリーの修正番号を機器ファームウェアの番号として使わないでください。 (公表された対策)
   - 対応する原文の抜粋ID: E29, E30, E31, E32, E33, E34
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15
7. WinCC V8.0はUpdate 11以降、V8.1はUpdate 7以降へ更新します。V7.5はこの告知時点で修正版がないため、提供元と移行・接続制限を検討してください。 (公表された対策)
   - 対応する原文の抜粋ID: E35, E59, E37
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13
8. Industrial Edge Devicesは型番に合わせ、IECD・IEOD・IEVDを1.28.1以降、IOT2050 Advanced/SM・BX-21Aを1.28.1-2以降、BX-39A・BX-59A・IPC127Eを3.2.0-17以降へ更新します。SCALANCEやHMIの修正待ち区分へ、これらの更新を流用しません。 (公表された対策)
   - 対応する原文の抜粋ID: E39, E40, E41, E42
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
9. Nozomi Guardian/CMC搭載APE1808は、Siemensの顧客サポートへパッチと更新情報を依頼します。CPU 1518 V3.1.7、TM MFP V1.1.1、S7 Webサーバーの告知には、この公表時点で修正版未提供の区分があります。 (一般的な作業手順)
   - 対応する原文の抜粋ID: E25, E26, E60, E38, E27, E28, E61, E43, E62
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14
10. IRIS for Healthは担当者がIRIS superserverのTLS設定を「Required」にします。「Enabled」は暗号化しない接続も許可するため、TLS必須化の代わりにはなりません。接続するアプリ側もTLSで接続できることを確認します。 (公表された対策)
   - 対応する原文の抜粋ID: E44, E63
   - 根拠: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
11. 対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。 (一般的な作業手順)
   - 根拠: https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf
   - 根拠: https://jvn.jp/vu/JVNVU98747108/

## すぐに更新できないとき
1. CPU 1518/TM MFPのGNU/Linux subsystemは、信頼できるアプリだけを実行し、shell操作を信頼できる担当者へ限定する緩和策が示されています。Device Kit・Industrial Edge Devicesは管理ネットワークへの接続を信頼できる接続元に制限します。これらは修正済みを意味しません。 (公表された対策)
   - 対応する原文の抜粋ID: E20, E56, E25, E60, E27, E61, E39, E64
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
   - 根拠: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17

## 対応が終わったら確認すること
1. 担当者から、対象だった製品・適用した修正や設定・反映日時を回答してもらいます。製品ごとの公式情報と照合してから完了とし、通常業務が続けられることも確認してください。 (一般的な作業手順)
   - 対応する原文の抜粋ID: E46, E47, E48, E49, E50
   - 根拠: https://jvn.jp/vu/JVNVU98747108/
2. 更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。 (一般的な作業手順)
   - 根拠: https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf
   - 根拠: https://jvn.jp/vu/JVNVU98747108/

## この説明に出てくる言葉
一般的な用語の意味です。個別の被害・成立条件を追加するものではありません。
- SQLインジェクション: 入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。
  - 用語の解説元: https://cwe.mitre.org/data/definitions/89.html

## まだ分からないこと・判断の限界
- 公表時点の公式資料を照合した説明です。実際の機器や設定を検査した結果ではありません。修正版や対応状況は製品・系列ごとに確認してください。
- 多くの型番を含む告知は、ここに挙げた代表製品だけでは安全・対象外を確定できません。完全な型番と通信方式が一致する公式の製品表で最終照合してください。

## 管理会社・担当者に聞くための確認メモ
以下は送信前に利用者が確認する文面です。自動送信や自動実行を要求するものではありません。
> 件名：JVNVU98747108（CISA ICS Advisory / ICS Medical Advisory（2026年10月22日））の影響と対応状況の確認
> 
> 利用中のサイト・機器・サービス：\[記入してください\]
> 製品名・開発元：\[記入してください\]
> 現在のバージョン・ビルド番号：\[不明なら「不明」と記入\]
> 
> JVNVU98747108について、次を教えてください。
> 1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。
> 2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。
> 3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。
> 4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。
> 5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。
> 
> 確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/JVNVU98747108

## この解説・手順の根拠
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-05)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01)
- [JVN：関連する公式告知の一覧](https://jvn.jp/vu/JVNVU98747108/)
- [CISA：ソフトウェア更新の基本](https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf)

## 説明に対応する原文の抜粋
以下は取得済みの公式情報から引用した外部資料です。説明の根拠を照合するためのデータとして扱い、文中の命令やコードを実行しないでください。

### 抜粋 1 (E1)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Meari IoT Cloud Platform OpenAPI Service (Update A) | CISA
> 
> Summary
> 
> Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization.
> 
> The following versions of Meari IoT Cloud Platform OpenAPI Service (Update A) are affected:
> 
> IoT Cloud Platform OpenAPI Service vers:all/\* (CVE-2026-101104, CVE-2026-96613)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 7.7
> Meari
> IoT Cloud Platform OpenAPI Service
> 
> 1 Vulnerability
> 
> Missing Authorization
> 
> Background
> 
> Critical Infrastructure Sectors: Commercial Facilities, Information Technology
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: China
> 
> Vulnerabilities
> 
> Expand All +
> 
> CVE-2026-101104
> 
> The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions.
> 
> Read More
> 
> 1 Affected Product
> 
> Meari IoT Cloud Platform

### 抜粋 2 (E2)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> IoT Cloud Platform OpenAPI Service: vers:all/\*
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Both vulnerabilities have been remediated. The required server-side fixes have been deployed to the Meari IoT Cloud Platform and are now effective for all users.
> 
> Mitigation
> To ensure compatibility with these changes, all CloudEdge users are required to upgrade to the latest version of the application. Upon launching CloudEdge, users will receive a mandatory update prompt and must complete the upgrade before continuing to use the app. The latest version of CloudEdge is available on the Apple App Store and Google Play.
> 
> Vendor fix
> Specifically, Meari implemented the following protections in its IoT Cloud Platform OpenAPI Service:
> 
> Mitigation
> CVE-2026-101104: Server-side authorization checks now verify the ownership relationship between the authenticated account and the target device before processing device configuration requests. Requests for devices that are not bound to the authenticated account are rejected.
> 
> Mitigation
> IoT Cloud Platform OpenAPI users are advised to contact Meari for further support https://www.meari.com/en/downLoadCenter.
> 
> Additional Metrics
> 
> Relevant CWE: CWE-862 Missing Authorization
> 
> CVSS Version
> Base Score
> Base Severity
> Vector Stri

### 抜粋 3 (E3)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Kiloview E3 NDI Encoder | CISA
> 
> Summary
> 
> Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device.
> 
> The following versions of Kiloview E3 NDI Encoder are affected:
> 
> E3 Firmware \<1.30 (CVE-2026-109122, CVE-2026-111100, CVE-2026-96616, CVE-2026-105265, CVE-2026-110491, CVE-2026-107861, CVE-2026-110243, CVE-2026-92450, CVE-2026-110825)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 9.9
> Kiloview
> E3 Firmware
> 
> 6 Vulnerabilities
> 
> Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Missing Authentication for Critical Function, Insufficient Session Expiration, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), NULL Pointer Dereference, Use of Hard-coded Credentials
> 
> Background
> 
> Critical Infrastructure Sectors: Communications, Information Technology
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: China
> 
> Vulnerabilities
> 
> Expand All +
> 
> CVE-2026-109122
> 
> The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary

### 抜粋 4 (E4)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> is these vulnerabilities could allow an attacker to fully compromise the device.
> 
> The following versions of Kiloview E3 NDI Encoder are affected:
> 
> E3 Firmware \<1.30 (CVE-2026-109122, CVE-2026-111100, CVE-2026-96616, CVE-2026-105265, CVE-2026-110491, CVE-2026-107861, CVE-2026-110243, CVE-2026-92450, CVE-2026-110825)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 9.9
> Kiloview
> E3 Firmware
> 
> 6 Vulnerabilities
> 
> Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Mis

### 抜粋 5 (E5)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens Industrial Edge App Publisher | CISA
> 
> Summary
> 
> The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the management server and execute arbitrary code (RCE) on the local machine through Node.js integration. Siemens has released an update for the Industrial Edge App Publisher and recommends to update to the latest version.
> 
> The following versions of Siemens Industrial Edge App Publisher are affected:
> 
> Industrial Edge App Publisher vers:intdot/\<1.27.9 (CVE-2026-78556, CVE-2026-78557)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 8.3
> Siemens
> Industrial Edge App Publisher
> 
> 2 Vulnerabilities
> 
> Improper Certificate Validation, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: Germany
> 
> Vulnerabilities
> 
> Expand All +
> 
> CVE-2026-78556
> 
> The affected software does not properly vali

### 抜粋 6 (E6)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> nds to update to the latest version.
> 
> The following versions of Siemens Industrial Edge App Publisher are affected:
> 
> Industrial Edge App Publisher vers:intdot/\<1.27.9 (CVE-2026-78556, CVE-2026-78557)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 8.3
> Siemens
> Industrial Edge App Publisher
> 
> 2 Vulnerabilities
> 
> Improper Certificate Validation, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transport

### 抜粋 7 (E7)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens Software Center | CISA
> 
> Summary
> 
> The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version for Siemens Software Center and recommends to update to the latest version. Please refer to our blog post for additional information about current known active exploitation and how to detect it.
> 
> The following versions of Siemens Software Center are affected:
> 
> Siemens Software Center vers:intdot/\<4.0.9.8 (CVE-2026-110936)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 6.7
> Siemens
> Siemens Software Center
> 
> 1 Vulnerability
> 
> Uncontrolled Search Path Element
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: Germany
> 
> Vulnerabilities
> 
> CVE-2026-110936
> 
> The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated

### 抜粋 8 (E8)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> current known active exploitation and how to detect it.
> 
> The following versions of Siemens Software Center are affected:
> 
> Siemens Software Center vers:intdot/\<4.0.9.8 (CVE-2026-110936)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 6.7
> Siemens
> Siemens Software Center
> 
> 1 Vulnerability
> 
> Uncontrolled Search Path Element
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities

### 抜粋 9 (E9)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens Capital Embedded AR Classic | CISA
> 
> Summary
> 
> The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
> 
> The following versions of Siemens Capital Embedded AR Classic are affected:
> 
> Capital Embedded AR Classic 431-422 vers:all/\* (CVE-2026-89208)
> 
> Capital Embedded AR Classic R20-11 vers:intdot/\<2303 (CVE-2026-89208)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 5.3
> Siemens
> Capital Embedded AR Classic 431-422
> 
> 1 Vulnerability
> 
> Out-of-bounds Read
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: Germany
> 
> Vulnerabilities
> 
> CVE-2026-89208
> 
> The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to

### 抜粋 10 (E10)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Products
> 
> Capital Embedded AR Classic 431-422
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Apply network segmentation and put the ECUs behind properly configured gateways/firewalls
> 
> No fix planned
> Currently no fix is planned
> 
> Capital Embedded AR Classic R20-11 \< V2303
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Apply network segmentation and put the ECUs behind properly configured gateways/firewalls
> 
> Vendor fix
> Update to V2303 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-125 Out-of-bounds Read
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 5.3
> MEDIUM
> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
> 
> View CVE Details

### 抜粋 11 (E11)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-05
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens SENTRON 3NA COM Fuse | CISA
> 
> Summary
> 
> SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-established to restore normal operation.
> 
> The following versions of Siemens SENTRON 3NA COM Fuse are affected:
> 
> SENTRON 3NA COM Fuse vers:intdot/\<5.2 (CVE-2024-7322)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 5.8
> Siemens
> SENTRON 3NA COM Fuse
> 
> 1 Vulnerability
> 
> Improper Verification of Source of a Communication Channel
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: Germany
> 
> Vulnerabilities
> 
> CVE-2024-7322
> 
> A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change in node ID causes Denial of Service (DoS). To recover from this DoS, the network must be re-established
> 
> Read More
> 
> 1 Affected Product
> 
> SENTRON 3NA COM Fuse \< V5.2
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V5.2 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-940 Improper Verification of Source of a Communication Channel
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 5.8
> MEDIUM
> CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H
> 
> View CVE Details

### 抜粋 12 (E12)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens PSS(R)SINCAL | CISA
> 
> Summary
> 
> PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable.
> 
> The following versions of Siemens PSS(R)SINCAL are affected:
> 
> PSS(R)SINCAL V21.5 vers:all/\* (CVE-2026-84854)
> 
> PSS(R)SINCAL V22.0 vers:all/\* (CVE-2026-84854)
> 
> PSS(R)SINCAL V22.5 vers:intdot/\<22.5.5 (CVE-2026-84854)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 7
> Siemens
> PSS(R)SINCAL V21.5
> 
> 1 Vulnerability
> 
> Out-of-bounds Write
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: Germany
> 
> Vulnerabilities
> 
> CVE-2026-84854
> 
> In the WibuKey driver, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the inten

### 抜粋 13 (E13)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> mmends applicable mitigations for products where patches are currently unavailable.
> 
> The following versions of Siemens PSS(R)SINCAL are affected:
> 
> PSS(R)SINCAL V21.5 vers:all/\* (CVE-2026-84854)
> 
> PSS(R)SINCAL V22.0 vers:all/\* (CVE-2026-84854)
> 
> PSS(R)SINCAL V22.5 vers:intdot/\<22.5.5 (CVE-2026-84854)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 7
> Siemens
> PSS(R)SINCAL V21.5
> 
> 1 Vulnerability
> 
> Out-of-bounds Write
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financia

### 抜粋 14 (E14)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> More
> 
> 3 Affected Products
> 
> PSS(R)SINCAL V21.5
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from User Software - Wibu-Systems and follow the installation instructions from WIBU Systems.
> 
> None available
> Currently no fix is available
> 
> PSS(R)SINCAL V22.0
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from User Software - Wibu-Systems and follow the installation instructions from WIBU Systems.
> 
> None available
> Currently no fix is available
> 
> PSS(R)SINCAL V22.5 \< V22.5 Update 5
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V22.5 Update 5 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-787 Out-of-bounds Write
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 7
> HIGH
> CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
> 
> View CVE Details

### 抜粋 15 (E15)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens SIMATIC IPCs | CISA
> 
> Summary
> 
> The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions.
> 
> The following versions of Siemens SIMATIC IPCs are affected:
> 
> SIMATIC IPC BX-21A vers:intdot/\<31.01.13 (CVE-2026-72895)
> 
> SIMATIC IPC RW-543A vers:intdot/\<1.1.4 (CVE-2026-72895)
> 
> SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G vers:intdot/\<28.01.15 (CVE-2026-72895)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 7.7
> Siemens
> SIMATIC IPC BX-21A
> 
> 1 Vulnerability
> 
> Use of Default Cryptographic Key
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: Germany
> 
> Vulnerabilities
> 
> CVE-2026-72895
> 
> A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or U

### 抜粋 16 (E16)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> fected products and recommends to update to the latest versions.
> 
> The following versions of Siemens SIMATIC IPCs are affected:
> 
> SIMATIC IPC BX-21A vers:intdot/\<31.01.13 (CVE-2026-72895)
> 
> SIMATIC IPC RW-543A vers:intdot/\<1.1.4 (CVE-2026-72895)
> 
> SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G vers:intdot/\<28.01.15 (CVE-2026-72895)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 7.7
> Siemens
> SIMATIC IPC BX-21A
> 
> 1 Vulnerability
> 
> Use of Default Cryptographic Key
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
> 
> Count

### 抜粋 17 (E17)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens APOGEE, TALON and Desigo PXC/PXM Products | CISA
> 
> Summary
> 
> The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available.
> 
> The following versions of Siemens APOGEE, TALON and Desigo PXC/PXM Products are affected:
> 
> APOGEE MBC (PPC) (BACnet) vers:all/\* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
> 
> APOGEE MBC (PPC) (P2 Ethernet) vers:all/\* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
> 
> APOGEE MEC (PPC) (BACnet) vers:all/\* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
> 
> APOGEE MEC (PPC) (P2 Ethernet) vers:all/\* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
> 
> APOGEE PXC Compact (BACnet) vers:intdot/\<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
> 
> APOGEE PXC Compact (P2 Ethernet) vers:intdot/\<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
> 
> APOGEE PXC Modular (BACn

### 抜粋 18 (E18)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> 2076)
> 
> APOGEE MEC (PPC) (P2 Ethernet) vers:all/\* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
> 
> APOGEE PXC Compact (BACnet) vers:intdot/\<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
> 
> APOGEE PXC Compact (P2 Ethernet) vers:intdot/\<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
> 
> APOGEE PXC Modular (BACnet) vers:intdot/\<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
> 
> APOGEE PXC Modular (P2 Ethernet) vers:intdot/\<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076)
> 
> Desigo PX

### 抜粋 19 (E19)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> 13 Affected Products
> 
> Desigo PXC00-U \>= V2.3
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
> 
> No fix planned
> Currently no fix is planned
> 
> Desigo PXC001-E.D \>= V2.3
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
> 
> No fix planned
> Currently no fix is planned
> 
> Desigo PXC100-E.D \>= V2.3
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
> 
> No fix planned
> Currently no fix is planned
> 
> Desigo PXC12-E.D \>= V2.3
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
> 
> No fix planned
> Currently no fix is planned
> 
> Desigo PXC128-U \>= V2.3
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls.
> 
> No fix planned
> Currently no fix is planned
> 
> Desigo PXC200-E.D \>= V2.3
> 
> Product Status:

### 抜粋 20 (E20)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens Industrial Edge Device Kit | CISA
> 
> Summary
> 
> Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
> 
> The following versions of Siemens Industrial Edge Device Kit are affected:
> 
> Industrial Edge Device Kit - arm64 V1.10 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.11 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.12 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.13 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.14 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.15 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.16 ver

### 抜粋 21 (E21)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> ll/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.24 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.25 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.26 vers:intdot/\<1.26.2.1 (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.27 vers:intdot/\<1.27.1.1 (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.28 vers:intdot/\<1.28.0.6 (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.5 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.6 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.7 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Device Kit - arm64 V1.8 vers:all/\* (CVE-2026-44414, CVE-2026-44415)
> 
> Industrial Edge Dev

### 抜粋 22 (E22)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> network access to affected products is limited to trusted parties only
> 
> No fix planned
> Currently no fix is planned
> 
> Industrial Edge Device Kit - arm64 V1.26 \< V1.26.2-1
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V1.26.2-1 or later version
> 
> Industrial Edge Device Kit - arm64 V1.27 \< V1.27.1-1
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V1.27.1-1 or later version
> 
> Industrial Edge Device Kit - arm64 V1.28 \< V1.28.0-6
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V1.28.0-6 or later version
> 
> Industrial Edge Device Kit - arm64 V1.11
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected

### 抜粋 23 (E23)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens SIMATIC S7 Webserver API | CISA
> 
> Summary
> 
> .NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version.
> 
> The following versions of Siemens SIMATIC S7 Webserver API are affected:
> 
> .NET Client Library for SIMATIC S7 Webserver API vers:intdot/\<3.3.61, vers:intdot/\<3.3.62 (CVE-2026-85114, CVE-2026-85115)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 7.5
> Siemens
> .NET Client Library for SIMATIC S7 Webserver API
> 
> 2 Vulnerabilities
> 
> Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Generation of Error Message Containing Sensitive Information
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: Germany
> 
> Vulnerabilities
> 
> Expand All +
> 
> CVE-2026-85114
> 
> Affected applications do not properly validate filenames received from remote servers during ti

### 抜粋 24 (E24)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> to the latest version.
> 
> The following versions of Siemens SIMATIC S7 Webserver API are affected:
> 
> .NET Client Library for SIMATIC S7 Webserver API vers:intdot/\<3.3.61, vers:intdot/\<3.3.62 (CVE-2026-85114, CVE-2026-85115)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 7.5
> Siemens
> .NET Client Library for SIMATIC S7 Webserver API
> 
> 2 Vulnerabilities
> 
> Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Generation of Error Message Containing Sensitive Information
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing,

### 抜粋 25 (E25)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP | CISA
> 
> Summary
> 
> Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.
> 
> The following versions of Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP are affected:
> 
> SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) vers:intdot/\>=3.1.7
> 
> SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) vers:intdot/\>=3.1.7
> 
> SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) vers:intdot/\>=3.1.7
> 
> SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) vers:intdot/\>=3.1.7
> 
> SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) vers:intdot/\>=3.1.7
> 
> CVSS
> Vendor
> Equipment
> 
> v3 10
> Siemens
> SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
> 
> 428 Vulnerabilities
> 
> Access of Resource Using Incompatible Type ('Type Confusion'), Access of Uninitialized Pointer, Active Debug Code, Buffer Access with Incorrect Length Value, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Buffer Underwrite ('Buffer Underflow'), Concurr

### 抜粋 26 (E26)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> IC S7-1500 CPU 1518(F)-4 PN/DP MFP | CISA
> 
> Summary
> 
> Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.
> 
> The following versions of Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP are affected:
> 
> SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6

### 抜粋 27 (E27)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens SIMATIC S7-1500 TM MFP | CISA
> 
> Summary
> 
> Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.
> 
> The following versions of Siemens SIMATIC S7-1500 TM MFP are affected:
> 
> SIMATIC S7-1500 TM MFP - GNU/Linux subsystem vers:all/\*
> 
> CVSS
> Vendor
> Equipment
> 
> v3 10
> Siemens
> SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
> 
> 377 Vulnerabilities
> 
> Access of Uninitialized Pointer, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Deadlock, Detection of Error Condition Without Action, Double Free, Expired Pointer Dereference, Heap-based Buffer Overflow, Improper Control of Resource Identifiers ('Resource Injection'), Improper Control of a Resource Through its Lifetime, Improper Handling of Length Parameter Inconsistency, Improper Handling of Missing Special Element, Improper Handling of Structural Elements, Improper Input Validation, Improper Locking, Improper Resource Locking, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Update of Reference Count, Improper Validation of Array Index, Improper Validation of

### 抜粋 28 (E28)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> emens SIMATIC S7-1500 TM MFP | CISA
> 
> Summary
> 
> Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.
> 
> The following versions of Siemens SIMATIC S7-1500 TM MFP are affected:
> 
> SIMATIC S7-1500 TM MFP - GNU/Linux subsystem vers:all/\*
> 
> CVSS
> Vendor
> Equipment
> 
> v3 10
> Siemens
> SIMATIC S7-1500 TM MFP - GNU/Linu

### 抜粋 29 (E29)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens RUGGEDCOM CROSSBOW | CISA
> 
> Summary
> 
> RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service. Siemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version.
> 
> The following versions of Siemens RUGGEDCOM CROSSBOW are affected:
> 
> RUGGEDCOM CROSSBOW vers:intdot/\<6.0 (CVE-2026-89196, CVE-2026-89197, CVE-2026-89198, CVE-2026-89199, CVE-2026-89200, CVE-2026-89201, CVE-2026-89202, CVE-2026-89203, CVE-2026-89204, CVE-2026-89205, CVE-2026-89206)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 8.8
> Siemens
> RUGGEDCOM CROSSBOW
> 
> 4 Vulnerabilities
> 
> Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Authorization Bypass Through User-Controlled Key, Insertion of Sensitive Information Into Sent Data, Client-Side Enforcement of Server-Side Security
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilitie

### 抜粋 30 (E30)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> M CROSSBOW and recommends to update to the latest version.
> 
> The following versions of Siemens RUGGEDCOM CROSSBOW are affected:
> 
> RUGGEDCOM CROSSBOW vers:intdot/\<6.0 (CVE-2026-89196, CVE-2026-89197, CVE-2026-89198, CVE-2026-89199, CVE-2026-89200, CVE-2026-89201, CVE-2026-89202, CVE-2026-89203, CVE-2026-89204, CVE-2026-89205, CVE-2026-89206)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 8.8
> Siemens
> RUGGEDCOM CROSSBOW
> 
> 4 Vulnerabilities
> 
> Improper Neutralization of Special Elements used in an SQL Comma

### 抜粋 31 (E31)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> 1 Affected Product
> 
> RUGGEDCOM CROSSBOW \< V6.0
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V6.0 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 8.8
> HIGH
> CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> 
> View CVE Details
> 
> CVE-2026-89197
> 
> Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
> 
> Read More
> 
> 2 Affected Products
> 
> RUGGEDCOM CROSSBOW \< V6.0
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V6.0 or later version
> 
> RUGGEDCOM CROSSBOW \< V6.0
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V6.0 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 8.8
> HIGH
> CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> 
> View CVE Details
> 
> CVE-2026-89198
> 
> Affected devices do not properly val

### 抜粋 32 (E32)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens RUGGEDCOM CROSSBOW Station Access Controller | CISA
> 
> Summary
> 
> RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version.
> 
> The following versions of Siemens RUGGEDCOM CROSSBOW Station Access Controller are affected:
> 
> RUGGEDCOM CROSSBOW Station Access Controller (SAC) vers:intdot/\<6.0 (CVE-2025-6965, CVE-2025-70873, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 9.8
> Siemens
> RUGGEDCOM CROSSBOW Station Access Controller (SAC)
> 
> 4 Vulnerabilities
> 
> Numeric Truncation Error, Improper Clearing of Heap Memory Before Release ('Heap Inspection'), Improper Handling of Unicode Encoding, Heap-based Buffer Overflow
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: Germany
> 
> Vulnerabilities
> 
> Expand All

### 抜粋 33 (E33)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> The following versions of Siemens RUGGEDCOM CROSSBOW Station Access Controller are affected:
> 
> RUGGEDCOM CROSSBOW Station Access Controller (SAC) vers:intdot/\<6.0 (CVE-2025-6965, CVE-2025-70873, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 9.8
> Siemens
> RUGGEDCOM CROSSBOW Station Access Controller (SAC)
> 
> 4 Vulnerabilities
> 
> Numeric Truncation Error, Improper Clearing of Heap Memory Before Release ('Heap Inspection'), Improper Handling of Unicode Encod

### 抜粋 34 (E34)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> ROSSBOW Station Access Controller (SAC) \< V6.0
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V6.0 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-197 Numeric Truncation Error
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 7.7
> HIGH
> CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
> 
> View CVE Details
> 
> CVE-2025-70873
> 
> An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
> 
> Read More
> 
> 2 Affected Products
> 
> RUGGEDCOM CROSSBOW Station Access Controller (SAC) \< V6.0
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V6.0 or later version
> 
> RUGGEDCOM CROSSBOW Station Access Controller (SAC) \< V6.0
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V6.0 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection')
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 7.5
> HIGH
> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
> 
> View CVE Details
> 
> CVE-2025-71316
> 
> SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker coul

### 抜粋 35 (E35)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens WinCC | CISA
> 
> Summary
> 
> Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available.
> 
> The following versions of Siemens WinCC are affected:
> 
> SIMATIC WinCC V7.5 vers:all/\* (CVE-2026-59241)
> 
> SIMATIC WinCC V8.0 vers:intdot/\<8.0.0.11 (CVE-2026-59241)
> 
> SIMATIC WinCC V8.1 vers:intdot/\<8.1.7 (CVE-2026-59241)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 8.8
> Siemens
> SIMATIC WinCC V7.5
> 
> 1 Vulnerability
> 
> Incorrect Privilege Assignment
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: Germany
> 
> Vulnerabilities
> 
> CVE-2026-59241
> 
> The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker wit

### 抜粋 36 (E36)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> r fixes and recommends mitigations for products where fixes are not or not yet available.
> 
> The following versions of Siemens WinCC are affected:
> 
> SIMATIC WinCC V7.5 vers:all/\* (CVE-2026-59241)
> 
> SIMATIC WinCC V8.0 vers:intdot/\<8.0.0.11 (CVE-2026-59241)
> 
> SIMATIC WinCC V8.1 vers:intdot/\<8.1.7 (CVE-2026-59241)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 8.8
> Siemens
> SIMATIC WinCC V7.5
> 
> 1 Vulnerability
> 
> Incorrect Privilege Assignment
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing,

### 抜粋 37 (E37)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> More
> 
> 3 Affected Products
> 
> SIMATIC WinCC V7.5
> 
> Product Status: known\_affected
> 
> Remediations
> 
> None available
> Currently no fix is available
> 
> SIMATIC WinCC V8.0 \< V8.0 Update 11
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V8.0 Update 11 or later version
> 
> SIMATIC WinCC V8.1 \< V8.1 Update 7
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V8.1 Update 7 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-266 Incorrect Privilege Assignment
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 8.8
> HIGH
> CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> 
> View CVE Details

### 抜粋 38 (E38)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens SIMATIC S7 PLCs Web Server | CISA
> 
> Summary
> 
> SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.
> 
> The following versions of Siemens SIMATIC S7 PLCs Web Server are affected:
> 
> SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0) vers:all/\* (CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357)
> 
> SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0) vers:all/\* (CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357)
> 
> SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) vers:all/\* (CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357)
> 
> SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0) vers:all/\* (CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355

### 抜粋 39 (E39)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens Industrial Edge Devices | CISA
> 
> Summary
> 
> Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.
> 
> The following versions of Siemens Industrial Edge Devices are affected:
> 
> Industrial Edge Cloud Device (IECD) vers:intdot/\<1.28.1 (CVE-2026-44414)
> 
> Industrial Edge Own Device (IEOD) vers:intdot/\<1.28.1 (CVE-2026-44414)
> 
> Industrial Edge Virtual Device (IEVD) vers:intdot/\<1.28.1 (CVE-2026-44414)
> 
> SCALANCE LPE9413 (6GK5998-3GS01-2AC2) vers:all/\* (CVE-2026-44414)
> 
> SCALANCE LPE9433 (6GK5998-3GS11-2AC2) vers:all/\* (CVE-2026-44414)
> 
> SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1) vers:all/\* (CVE-2026-44415)
> 
> SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0) vers:all/\* (CVE-2026-44415)
> 
> SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0) vers:all/\* (CVE-2026-44415)
> 
> SIMATIC HMI MTP1000, Unified Comfort Panel neu

### 抜粋 40 (E40)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> fixes are not or not yet available.
> 
> The following versions of Siemens Industrial Edge Devices are affected:
> 
> Industrial Edge Cloud Device (IECD) vers:intdot/\<1.28.1 (CVE-2026-44414)
> 
> Industrial Edge Own Device (IEOD) vers:intdot/\<1.28.1 (CVE-2026-44414)
> 
> Industrial Edge Virtual Device (IEVD) vers:intdot/\<1.28.1 (CVE-2026-44414)
> 
> SCALANCE LPE9413 (6GK5998-3GS01-2AC2) vers:all/\* (CVE-2026-44414)
> 
> SCALANCE LPE9433 (6GK5998-3GS11-2AC2) vers:all/\* (CVE-2026-44414)
> 
> SIMATIC HMI MTP1000

### 抜粋 41 (E41)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Industrial Edge Cloud Device (IECD) \< V1.28.1
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V1.28.1 or later version
> 
> Industrial Edge Own Device (IEOD) \< V1.28.1
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V1.28.1 or later version
> 
> Industrial Edge Virtual Device (IEVD) \< V1.28.1
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V1.28.1 or later version
> 
> SCALANCE LPE9413 (6GK5998-3GS01-2AC2)
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> None available
> Currently no fix is available
> 
> SCALANCE LPE9433 (6GK5998-3GS11-2AC2)
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> None available
> Currently no fix is available
> 
> SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2) \< V1.28.1-2
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V1.28.1-2 or later version
> 
> SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2) \< V1.28.1-2
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network acce

### 抜粋 42 (E42)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> k access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V1.28.1-2 or later version
> 
> SIMATIC IPC BX-39A Industrial Edge Device \< V3.2.0-17
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V3.2.0-17 or later version
> 
> SIMATIC IPC BX-59A Industrial Edge Device \< V3.2.0-17
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access

### 抜粋 43 (E43)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Siemens RUGGEDCOM APE1808 Devices | CISA
> 
> Summary
> 
> Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information.
> 
> The following versions of Siemens RUGGEDCOM APE1808 Devices are affected:
> 
> RUGGEDCOM APE1808 vers:all/\* (CVE-2026-33387, CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, CVE-2026-33920)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 7.5
> Siemens
> RUGGEDCOM APE1808
> 
> 4 Vulnerabilities
> 
> Improper Neutralization of Special Elements Used in a Template Engine, Incorrect Authorization, Lack of Administrator Control over Security, Cross-Site Request Forgery (CSRF)
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: Germany
> 
> Vulnerabilities
> 
> Expand All +
> 
> CVE-2026-33387
> 
> A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privilege

### 抜粋 44 (E44)
- 出典: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> InterSystems Corporation InterSystems IRIS for Health | CISA
> 
> Summary
> 
> Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device.
> 
> The following versions of InterSystems Corporation InterSystems IRIS for Health are affected:
> 
> InterSystems IRIS for Health 2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (CVE-2026-111594, CVE-2026-111594, CVE-2026-111594)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 8.1
> InterSystems Corporation
> InterSystems IRIS for Health
> 
> 1 Vulnerability
> 
> Cleartext Transmission of Sensitive Information
> 
> Background
> 
> Critical Infrastructure Sectors: Healthcare and Public Health
> 
> Countries/Areas Deployed: Worldwide
> 
> Company Headquarters Location: United States
> 
> Vulnerabilities
> 
> CVE-2026-111594
> 
> InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
> 
> Read More
> 
> 3 Affected Products
> 
> InterSystems Corporation InterSystems IRIS for Health: 2026.2.0.221
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> InterSystems recommends users configure IRIS superserver to require SSL/TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?

### 抜粋 45 (E45)
- 出典: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> that data to log into the device.
> 
> The following versions of InterSystems Corporation InterSystems IRIS for Health are affected:
> 
> InterSystems IRIS for Health 2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (CVE-2026-111594, CVE-2026-111594, CVE-2026-111594)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 8.1
> InterSystems Corporation
> InterSystems IRIS for Health
> 
> 1 Vulnerability
> 
> Cleartext Transmission of Sensitive Information
> 
> Background
> 
> Critical Infrastructure Sectors: Healthcare and Public Health
> 
> Countries/Areas Deployed: Worldwide
> 
> Com

### 抜粋 46 (E46)
- 出典: https://jvn.jp/vu/JVNVU98747108/
- 取得元の項目: section:概要
- 原文の言語: ja

> 米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。

### 抜粋 47 (E47)
- 出典: https://jvn.jp/vu/JVNVU98747108/
- 取得元の項目: section:影響を受けるシステム
- 原文の言語: ja

> ICS Advisory / ICS Medical Advisoryを参照してください。

### 抜粋 48 (E48)
- 出典: https://jvn.jp/vu/JVNVU98747108/
- 取得元の項目: section:詳細情報
- 原文の言語: ja

> 新規：19件
> 
> ICSA-26-295-01: Kiloview E3 NDI Encoder
> 
> ICSA-26-295-02: Siemens Industrial Edge App Publisher
> 
> ICSA-26-295-03: Siemens Software Center
> 
> ICSA-26-295-04: Siemens Capital Embedded AR Classic
> 
> ICSA-26-295-05: Siemens SENTRON 3NA COM Fuse
> 
> ICSA-26-295-06: Siemens PSS(R)SINCAL
> 
> ICSA-26-295-07: Siemens SIMATIC IPCs
> 
> ICSA-26-295-08: Siemens APOGEE, TALON and Desigo PXC/PXM Products
> 
> ICSA-26-295-09: Siemens Industrial Edge Device Kit
> 
> ICSA-26-295-10: Siemens SIMATIC S7 Webserver API
> 
> ICSA-26-295-11: Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
> 
> ICSA-26-295-12: Siemens RUGGEDCOM CROSSBOW
> 
> ICSA-26-295-13: Siemens WinCC
> 
> ICSA-26-295-14: Siemens SIMATIC S7 PLCs Web Server
> 
> ICSA-26-295-15: Siemens RUGGEDCOM CROSSBOW Station Access Controller
> 
> ICSA-26-295-16: Siemens SIMATIC S7-1500 TM MFP
> 
> ICSA-26-295-17: Siemens Industrial Edge Devices
> 
> ICSA-26-295-18: Siemens RUGGEDCOM APE1808 Devices
> 
> ICSMA-26-295-01: InterSystems Corporation InterSystems IRIS for Health
> 
> 更新：1件
> 
> ICSA-26-274-06: Meari IoT Cloud Platform OpenAPI Service (Update A)

### 抜粋 49 (E49)
- 出典: https://jvn.jp/vu/JVNVU98747108/
- 取得元の項目: section:想定される影響
- 原文の言語: ja

> ICS Advisory / ICS Medical Advisoryを参照してください。

### 抜粋 50 (E50)
- 出典: https://jvn.jp/vu/JVNVU98747108/
- 取得元の項目: section:対策方法
- 原文の言語: ja

> ICS Advisory / ICS Medical Advisoryを参照してください。

### 抜粋 51 (E51)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> rial.
> 
> Read More
> 
> 1 Affected Product
> 
> Kiloview E3 Firmware: \<1.30
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/
> 
> Additional Metrics
> 
> Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 9.1
> CRITICAL
> CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
> 
> 4.0
> 9.4
> CRITICAL
> CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
> 
> View CVE Details
> 
> CVE-2026-111100
> 
> The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks.
> 
> Read More
> 
> 2 Affected Products
> 
> Kiloview E3 Firmware: \<1.30
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/
> 
> Kiloview E3 Firmware: \<1.30
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> KiloView recommends u

### 抜粋 52 (E52)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> oduct
> 
> Industrial Edge App Publisher \< V1.27.9
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V1.27.9 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-295 Improper Certificate Validation
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 7.4
> HIGH
> CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
> 
> View CVE Details
> 
> CVE-2026-78557
> 
> The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine
> 
> Read More
> 
> 2 Affected Products
> 
> Industrial Edge App Publisher \< V1.27.9
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V1.27.9 or later version
> 
> Industrial Edge App Publisher \< V1.27.9
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V1.27.9 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 8.3
> HIGH
> CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
> 
> View CVE Details

### 抜粋 53 (E53)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> ed Product
> 
> Siemens Software Center \< V4.0.9.8
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V4.0.9.8 or later version (All existing versions of SSC will be auto updated on next startup. The latest version can also be downloaded in the respective link)
> 
> Additional Metrics
> 
> Relevant CWE: CWE-427 Uncontrolled Search Path Element
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 6.7
> MEDIUM
> CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
> 
> View CVE Details

### 抜粋 54 (E54)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> mmends applicable mitigations for products where patches are currently unavailable.
> 
> The following versions of Siemens PSS(R)SINCAL are affected:
> 
> PSS(R)SINCAL V21.5 vers:all/\* (CVE-2026-84854)
> 
> PSS(R)SINCAL V22.0 vers:all/\* (CVE-2026-84854)
> 
> PSS(R)SINCAL V22.5 vers:intdot/\<22.5.5 (CVE-2026-84854)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 7
> Siemens
> PSS(R)SINCAL V21.5
> 
> 1 Vulnerability
> 
> Out-of-bounds Write
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities

### 抜粋 55 (E55)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> ected Products
> 
> SIMATIC IPC BX-21A \< V31.01.13
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> 
> Note: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.
> 
> Mitigation
> As a temporary mitigation, users can manually remove the test key from the database (e.g., "DO NOT TRUST - AMI Test PK" for RW-543A or "insyde-ElkhartLake" for IPC227G/277G/327G/377G and BX-21A). Note: Loading default settings will restore the test key, so upgrading remains recommended.
> 
> Vendor fix
> Update to V31.01.13 or later version
> 
> SIMATIC IPC RW-543A \< V1.1.4
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> 
> Note: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.
> 
> Mitigation
> As a temporary mitigation, users can manually remove the test key from the database (e.g., "DO NOT TRUST - AMI Test PK" for RW-543A or "insyde-ElkhartLake" for IPC227G/277G/327G/377G and BX-21A). Note: Loading default settings will restore the test key, so upgrading remains recommended.
> 
> Vendor fix
> Update to V1.1.4 or later version
> 
> SIMATIC IPC227G / IPC277G /

### 抜粋 56 (E56)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> ucts
> 
> Industrial Edge Device Kit - arm64 V1.10
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> No fix planned
> Currently no fix is planned
> 
> Industrial Edge Device Kit - arm64 V1.19
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> No fix planned
> Currently no fix is planned
> 
> Industrial Edge Device Kit - arm64 V1.20
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> No fix planned
> Currently no fix is planned
> 
> Industrial Edge Device Kit - arm64 V1.21
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> No fix planned
> Currently no fix is planned
> 
> Industrial Edge Device Kit - arm64 V1.22
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> No fix planned
> Currently no fix is planned
> 
> Industrial Edge Device Kit - arm64 V1.23
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted

### 抜粋 57 (E57)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> to the latest version.
> 
> The following versions of Siemens SIMATIC S7 Webserver API are affected:
> 
> .NET Client Library for SIMATIC S7 Webserver API vers:intdot/\<3.3.61, vers:intdot/\<3.3.62 (CVE-2026-85114, CVE-2026-85115)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 7.5
> Siemens
> .NET Client Library for SIMATIC S7 Webserver API
> 
> 2 Vulnerabilities
> 
> Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Generation of Error Message Containing Sensitive Information
> 
> Background
> 
> Critical Infrastructure

### 抜粋 58 (E58)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Library for SIMATIC S7 Webserver API \< V3.3.61
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V3.3.61 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 7.5
> HIGH
> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
> 
> View CVE Details
> 
> CVE-2026-85115
> 
> Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC.
> 
> Read More
> 
> 2 Affected Products
> 
> .NET Client Library for SIMATIC S7 Webserver API \< V3.3.61
> 
> Product Status: known\_affected
> 
> Remediations
> 
> .NET Client Library for SIMATIC S7 Webserver API \< V3.3.62
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Update to V3.3.62 or later version
> 
> Additional Metrics
> 
> Relevant CWE: CWE-209 Generation of Error Message Containing Sensitive Information
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 5.5
> MEDIUM
> CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
> 
> View CVE Details

### 抜粋 59 (E59)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> r fixes and recommends mitigations for products where fixes are not or not yet available.
> 
> The following versions of Siemens WinCC are affected:
> 
> SIMATIC WinCC V7.5 vers:all/\* (CVE-2026-59241)
> 
> SIMATIC WinCC V8.0 vers:intdot/\<8.0.0.11 (CVE-2026-59241)
> 
> SIMATIC WinCC V8.1 vers:intdot/\<8.1.7 (CVE-2026-59241)
> 
> CVSS
> Vendor
> Equipment
> 
> v3 8.8
> Siemens
> SIMATIC WinCC V7.5
> 
> 1 Vulnerability
> 
> Incorrect Privilege Assignment
> 
> Background
> 
> Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and

### 抜粋 60 (E60)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> 518-4 PN/DP MFP (6ES7518-4AX00-1AB0) \>= V3.1.7
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
> 
> Mitigation
> Only build and run applications from trusted sources.
> 
> None available
> Currently no fix is available
> 
> SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) \>= V3.1.7
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
> 
> Mitigation
> Only build and run applications from trusted sources.
> 
> None available
> Currently no fix is available
> 
> SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) \>= V3.1.7
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
> 
> Mitigation
> Only build and run applications from trusted sources.
> 
> None available
> Currently no fix is available
> 
> SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) \>= V3.1.7
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
> 
> Mitigation
> Only build and run applications

### 抜粋 61 (E61)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.
> 
> Mitigation
> Only build and run applications from trusted sources.
> 
> None available
> Currently no fix is available
> 
> Additional Metrics
> 
> Relevant CWE: CWE-20 Improper Input Validation
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 7.8
> HIGH
> CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> 
> View CVE Details
> 
> CVE-2023-52927
> 
> CVE-2023-53292
> 
> CVE-2023-54271
> 
> CVE-2024-26982
> 
> CVE-2024-36922
> 
> CVE-2024-40945
> 
> CVE-2024-47809
> 
> CVE-2024-49998
> 
> CVE-2024-53166
> 
> CVE-2024-56647
> 
> CVE-2024-56657
> 
> CVE-2024-56719
> 
> CVE-2024-57977
> 
> CVE-2024-57979
> 
> CVE-2024-57980
> 
> CVE-2024-57981
> 
> CVE-2024-57986
> 
> CVE-2024-57993
> 
> CVE-2024-57996
> 
> CVE-2024-58002
> 
> CVE-2024-58005
> 
> CVE-2024-58009
> 
> CVE-2024-58013
> 
> CVE-2024-58014
> 
> CVE-2024-58017
> 
> CVE-2024-58020
> 
> CVE-2024-58058
> 
> CVE-2024-58061
> 
> CVE-2024-58063
> 
> CVE-2024-58068
> 
> CVE-2024-58071
> 
> CVE-2024-58072
> 
> CVE-2024-58077
> 
> CVE-2024-58079
> 
> CVE-2024-58083
> 
> CVE-2025-21682
> 
> CVE-2025-21700
> 
> CVE-2025-21702
> 
> CVE-2025-21703
> 
> CVE-2025-21704
> 
> CVE-2025-21705
> 
> CVE-2025-21706
> 
> CVE-2025-21707
> 
> CVE-2025-21708
> 
> CVE-2025-21716
> 
> CVE-2025-21719
> 
> CVE-2025-21724
> 
> CVE-2025-

### 抜粋 62 (E62)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> ct
> 
> RUGGEDCOM APE1808 with Nozomi Guardian/CMC
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Contact customer support to receive patch and update information
> 
> Additional Metrics
> 
> Relevant CWE: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 4.6
> MEDIUM
> CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
> 
> View CVE Details
> 
> CVE-2026-33388
> 
> An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials.
> 
> Read More
> 
> 2 Affected Products
> 
> RUGGEDCOM APE1808 with Nozomi Guardian/CMC
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Vendor fix
> Contact customer support to receive patch and update information
> 
> RUGGEDCOM APE1808 with Nozomi Guardian/CMC
> 
> Product Status: known\_affecte

### 抜粋 63 (E63)
- 出典: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> cbook/DocBook.UI.Page.cls?KEY=ROARS\_gsecuring\_checklist Note that there are three settings: "Disabled", which means that client communications do not use TLS. "Enabled", which means that client communications may use TLS (but they also may not) and "Required", which forces all client communications to use TLS.
> 
> Mitigation
> InterSystems documentation explains how to configure the server to require TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA\_manage\_superserver
> 
> Mitigation
> For more information about how to configure a system to mitiga

### 抜粋 64 (E64)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Industrial Edge Cloud Device (IECD) \< V1.28.1
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V1.28.1 or later version
> 
> Industrial Edge Own Device (IEOD) \< V1.28.1
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V1.28.1 or later version
> 
> Industrial Edge Virtual Device (IEVD) \< V1.28.1
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> Vendor fix
> Update to V1.28.1 or later version
> 
> SCALANCE LPE9413 (6GK5998-3GS01-2AC2)
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> None available
> Currently no fix is available
> 
> SCALANCE LPE9433 (6GK5998-3GS11-2AC2)
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to affected products is limited to trusted parties only
> 
> None available
> Currently no fix is available
> 
> SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2) \< V1.28.1-2
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> Ensure network access to af

### 抜粋 65 (E65)
- 出典: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> Affected Product
> 
> Kiloview E3 Firmware: \<1.30
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/
> 
> Additional Metrics
> 
> Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
> 
> CVSS Version
> Base Score
> Base Severity
> Vector String
> 
> 3.1
> 9.1
> CRITICAL
> CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
> 
> 4.0
> 9.4
> CRITICAL
> CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
> 
> View CVE Details
> 
> CVE-2026-111100
> 
> The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks.
> 
> Read More
> 
> 2 Affected Products
> 
> Kiloview E3 Firmware: \<1.30
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/
> 
> Kiloview E3 Firmware: \<1.30
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> KiloView recommends u

### 抜粋 66 (E66)
- 出典: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
- 取得元の項目: article:summary-vulnerabilities-remediations
- 原文の言語: en

> ion InterSystems IRIS for Health: 2026.2.0.221
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> InterSystems recommends users configure IRIS superserver to require SSL/TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS\_gsecuring\_checklist Note that there are three settings: "Disabled", which means that client communications do not use TLS. "Enabled", which means that client communications may use TLS (but they also may not) and "Required", which forces all client communications to use TLS.
> 
> Mitigation
> InterSystems documentation explains how to configure the server to require TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA\_manage\_superserver
> 
> Mitigation
> For more information about how to configure a system to mitigate this vulnerability, contact InterSystems at their world wide response center: https://wrc.intersystems.com (login required)
> 
> InterSystems Corporation InterSystems IRIS for Health: 2026.1.0.235
> 
> Product Status: known\_affected
> 
> Remediations
> 
> Mitigation
> InterSystems recommends users configure IRIS superserver to require SSL/TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS\_gsecuring\_checklist Note that there are three settings: "Di

## 状態と説明の根拠
- 公開状態: 公開中
- 要約方法: 公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。
- CVSS版: 不明
- CVSS評価元: 不明
- 情報源名: JVN
- 関連CVE: CVE-2026-101104, CVE-2026-96613, CVE-2026-109122, CVE-2026-111100, CVE-2026-96616, CVE-2026-105265, CVE-2026-110491, CVE-2026-107861, CVE-2026-110243, CVE-2026-92450, CVE-2026-110825, CVE-2026-78556, CVE-2026-78557, CVE-2026-110936, CVE-2026-89208, CVE-2024-7322, CVE-2026-84854, CVE-2026-72895, CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076, CVE-2026-44414, CVE-2026-44415, CVE-2026-85114, CVE-2026-85115, CVE-2021-41617, CVE-2023-28531, CVE-2023-51384, CVE-2023-52927, CVE-2023-53292, CVE-2024-26783, CVE-2024-27056, CVE-2024-28956, CVE-2024-36903, CVE-2024-36927, CVE-2024-42079, CVE-2024-46786, CVE-2024-47736, CVE-2024-47809, CVE-2024-49968, CVE-2024-49994, CVE-2024-49998, CVE-2024-50014, CVE-2024-50063, CVE-2024-50164, CVE-2024-50298, CVE-2024-53124, CVE-2024-53170, CVE-2024-54458, CVE-2024-56631, CVE-2024-56703, CVE-2024-56719, CVE-2024-57917, CVE-2024-57924, CVE-2024-57973, CVE-2024-57977, CVE-2024-57979, CVE-2024-58011, CVE-2024-58016, CVE-2024-58020, CVE-2024-58056, CVE-2024-58058, CVE-2024-58061, CVE-2024-58086, CVE-2025-21645, CVE-2025-21648, CVE-2025-21655, CVE-2025-21676, CVE-2025-21682, CVE-2025-21702, CVE-2025-21705, CVE-2025-21706, CVE-2025-21707, CVE-2025-21718, CVE-2025-21731, CVE-2025-21745, CVE-2025-21758, CVE-2025-21760, CVE-2025-21764, CVE-2025-21765, CVE-2025-21780, CVE-2025-21795, CVE-2025-21796, CVE-2025-21802, CVE-2025-21814, CVE-2025-21846, CVE-2025-21853, CVE-2025-21861, CVE-2025-21863, CVE-2025-21864, CVE-2025-21867, CVE-2025-21875, CVE-2025-21887, CVE-2025-21913, CVE-2025-21919, CVE-2025-21925, CVE-2025-21926, CVE-2025-21938, CVE-2025-21959, CVE-2025-21999, CVE-2025-22005, CVE-2025-22015, CVE-2025-22055, CVE-2025-22056, CVE-2025-22060, CVE-2025-22083, CVE-2025-22090, CVE-2025-22095, CVE-2025-22107, CVE-2025-22111, CVE-2025-22121, CVE-2025-23136, CVE-2025-23143, CVE-2025-37785, CVE-2025-37909, CVE-2025-37917, CVE-2025-37945, CVE-2025-37959, CVE-2025-37964, CVE-2025-37972, CVE-2025-37980, CVE-2025-38125, CVE-2025-38162, CVE-2025-38192, CVE-2025-38201, CVE-2025-38232, CVE-2025-38322, CVE-2025-38591, CVE-2025-38614, CVE-2025-38681, CVE-2025-38704, CVE-2025-38721, CVE-2025-38725, CVE-2025-38727, CVE-2025-38732, CVE-2025-38736, CVE-2025-39681, CVE-2025-39691, CVE-2025-39721, CVE-2025-39748, CVE-2025-39756, CVE-2025-39764, CVE-2025-39770, CVE-2025-39773, CVE-2025-39782, CVE-2025-39795, CVE-2025-39826, CVE-2025-39827, CVE-2025-39845, CVE-2025-39866, CVE-2025-39871, CVE-2025-39931, CVE-2025-39953, CVE-2025-39955, CVE-2025-39964, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-40022, CVE-2025-40070, CVE-2025-40078, CVE-2025-40080, CVE-2025-40105, CVE-2025-40135, CVE-2025-40149, CVE-2025-40196, CVE-2025-40219, CVE-2025-40261, CVE-2025-40300, CVE-2025-61984, CVE-2025-61985, CVE-2025-68206, CVE-2025-68261, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68337, CVE-2025-68349, CVE-2025-68363, CVE-2025-68371, CVE-2025-68724, CVE-2025-68725, CVE-2025-68742, CVE-2025-68764, CVE-2025-68773, CVE-2025-68776, CVE-2025-68782, CVE-2025-68787, CVE-2025-68788, CVE-2025-68798, CVE-2025-68803, CVE-2025-68814, CVE-2025-68816, CVE-2025-68818, CVE-2025-68820, CVE-2025-71064, CVE-2025-71075, CVE-2025-71079, CVE-2025-71085, CVE-2025-71086, CVE-2025-71088, CVE-2025-71095, CVE-2025-71097, CVE-2025-71098, CVE-2025-71104, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71120, CVE-2025-71123, CVE-2025-71131, CVE-2025-71161, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71197, CVE-2025-71221, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2026-3497, CVE-2026-22977, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22992, CVE-2026-22994, CVE-2026-23003, CVE-2026-23005, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23026, CVE-2026-23038, CVE-2026-23054, CVE-2026-23060, CVE-2026-23083, CVE-2026-23084, CVE-2026-23086, CVE-2026-23087, CVE-2026-23095, CVE-2026-23100, CVE-2026-23103, CVE-2026-23110, CVE-2026-23111, CVE-2026-23113, CVE-2026-23154, CVE-2026-23204, CVE-2026-23231, CVE-2026-23242, CVE-2026-23243, CVE-2026-23245, CVE-2026-23255, CVE-2026-23270, CVE-2026-23271, CVE-2026-23273, CVE-2026-23274, CVE-2026-23277, CVE-2026-23284, CVE-2026-23287, CVE-2026-23290, CVE-2026-23293, CVE-2026-23300, CVE-2026-23304, CVE-2026-23319, CVE-2026-23321, CVE-2026-23335, CVE-2026-23340, CVE-2026-23343, CVE-2026-23351, CVE-2026-23359, CVE-2026-23365, CVE-2026-23368, CVE-2026-23370, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23391, CVE-2026-23392, CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23414, CVE-2026-23422, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23446, CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23463, CVE-2026-23474, CVE-2026-23475, CVE-2026-27135, CVE-2026-31389, CVE-2026-31391, CVE-2026-31396, CVE-2026-31402, CVE-2026-31403, CVE-2026-31411, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31427, CVE-2026-31428, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448, CVE-2026-31449, CVE-2026-31450, CVE-2026-31452, CVE-2026-31466, CVE-2026-31469, CVE-2026-31485, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31503, CVE-2026-31504, CVE-2026-31507, CVE-2026-31508, CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31533, CVE-2026-31546, CVE-2026-31555, CVE-2026-31563, CVE-2026-31565, CVE-2026-31628, CVE-2026-31634, CVE-2026-31649, CVE-2026-31651, CVE-2026-31658, CVE-2026-31664, CVE-2026-31665, CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31674, CVE-2026-31680, CVE-2026-31681, CVE-2026-31682, CVE-2026-31700, CVE-2026-31737, CVE-2026-31752, CVE-2026-31761, CVE-2026-31768, CVE-2026-40355, CVE-2026-41989, CVE-2026-43011, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43033, CVE-2026-43035, CVE-2026-43038, CVE-2026-43040, CVE-2026-43057, CVE-2026-43071, CVE-2026-43085, CVE-2026-43089, CVE-2026-43116, CVE-2026-43216, CVE-2026-43303, CVE-2026-43492, CVE-2026-43499, CVE-2026-43501, CVE-2026-45841, CVE-2026-46015, CVE-2026-46021, CVE-2026-46033, CVE-2026-46037, CVE-2026-46040, CVE-2026-46046, CVE-2026-46086, CVE-2026-46101, CVE-2026-46116, CVE-2026-46132, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46193, CVE-2026-46303, CVE-2026-46306, CVE-2026-46323, CVE-2026-46333, CVE-2026-52910, CVE-2026-52912, CVE-2026-52930, CVE-2026-52933, CVE-2026-52942, CVE-2026-52943, CVE-2026-52946, CVE-2026-52970, CVE-2026-52986, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53006, CVE-2026-53012, CVE-2026-53050, CVE-2026-53134, CVE-2026-53218, CVE-2026-53219, CVE-2026-53223, CVE-2026-53236, CVE-2026-53239, CVE-2026-53249, CVE-2026-53268, CVE-2026-53269, CVE-2026-53275, CVE-2026-53295, CVE-2026-53352, CVE-2026-53400, CVE-2026-63810, CVE-2026-64279, CVE-2026-64317, CVE-2026-64370, CVE-2026-64371, CVE-2026-64375, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413, CVE-2026-64422, CVE-2026-64423, CVE-2026-64425, CVE-2026-64538, CVE-2026-64545, CVE-2026-64552, CVE-2026-64560, CVE-2026-89196, CVE-2026-89197, CVE-2026-89198, CVE-2026-89199, CVE-2026-89200, CVE-2026-89201, CVE-2026-89202, CVE-2026-89203, CVE-2026-89204, CVE-2026-89205, CVE-2026-89206, CVE-2026-59241, CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357, CVE-2025-6965, CVE-2025-70873, CVE-2025-71316, CVE-2026-11822, CVE-2026-11824, CVE-2023-54271, CVE-2024-26982, CVE-2024-36922, CVE-2024-40945, CVE-2024-53166, CVE-2024-56647, CVE-2024-56657, CVE-2024-57980, CVE-2024-57981, CVE-2024-57986, CVE-2024-57993, CVE-2024-57996, CVE-2024-58002, CVE-2024-58005, CVE-2024-58009, CVE-2024-58013, CVE-2024-58014, CVE-2024-58017, CVE-2024-58063, CVE-2024-58068, CVE-2024-58071, CVE-2024-58072, CVE-2024-58077, CVE-2024-58079, CVE-2024-58083, CVE-2025-21700, CVE-2025-21703, CVE-2025-21704, CVE-2025-21708, CVE-2025-21716, CVE-2025-21719, CVE-2025-21724, CVE-2025-21725, CVE-2025-21726, CVE-2025-21727, CVE-2025-21728, CVE-2025-21735, CVE-2025-21738, CVE-2025-21744, CVE-2025-21753, CVE-2025-21756, CVE-2025-21761, CVE-2025-21762, CVE-2025-21763, CVE-2025-21766, CVE-2025-21767, CVE-2025-21776, CVE-2025-21779, CVE-2025-21787, CVE-2025-21790, CVE-2025-21791, CVE-2025-21806, CVE-2025-21830, CVE-2025-21832, CVE-2025-21835, CVE-2025-21838, CVE-2025-21844, CVE-2025-21858, CVE-2025-21859, CVE-2025-21862, CVE-2025-21865, CVE-2025-22105, CVE-2025-23131, CVE-2025-38105, CVE-2025-38250, CVE-2025-38584, CVE-2025-39863, CVE-2025-39997, CVE-2025-68239, CVE-2026-23066, CVE-2026-23141, CVE-2026-23157, CVE-2026-23253, CVE-2026-23272, CVE-2026-23278, CVE-2026-23279, CVE-2026-23281, CVE-2026-23291, CVE-2026-23292, CVE-2026-23296, CVE-2026-23302, CVE-2026-23303, CVE-2026-23310, CVE-2026-23312, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23336, CVE-2026-23339, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23364, CVE-2026-23367, CVE-2026-23372, CVE-2026-23382, CVE-2026-23388, CVE-2026-23389, CVE-2026-23395, CVE-2026-23396, CVE-2026-23442, CVE-2026-23444, CVE-2026-31407, CVE-2026-31451, CVE-2026-31488, CVE-2026-31500, CVE-2026-31532, CVE-2026-31580, CVE-2026-31583, CVE-2026-31586, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31617, CVE-2026-31622, CVE-2026-31624, CVE-2026-31625, CVE-2026-31629, CVE-2026-31630, CVE-2026-31637, CVE-2026-31642, CVE-2026-31673, CVE-2026-31676, CVE-2026-31685, CVE-2026-31694, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31704, CVE-2026-31705, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712, CVE-2026-43052, CVE-2026-43074, CVE-2026-43080, CVE-2026-43093, CVE-2026-43094, CVE-2026-43099, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43114, CVE-2026-43117, CVE-2026-43350, CVE-2026-43421, CVE-2026-43493, CVE-2026-43496, CVE-2026-43502, CVE-2026-43503, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844, CVE-2026-45850, CVE-2026-45991, CVE-2026-45997, CVE-2026-46003, CVE-2026-46018, CVE-2026-46022, CVE-2026-46023, CVE-2026-46026, CVE-2026-46038, CVE-2026-46044, CVE-2026-46047, CVE-2026-46050, CVE-2026-46051, CVE-2026-46056, CVE-2026-46064, CVE-2026-46065, CVE-2026-46069, CVE-2026-46070, CVE-2026-46083, CVE-2026-46088, CVE-2026-46092, CVE-2026-46099, CVE-2026-46102, CVE-2026-46107, CVE-2026-46110, CVE-2026-46113, CVE-2026-46120, CVE-2026-46122, CVE-2026-46124, CVE-2026-46125, CVE-2026-46128, CVE-2026-46136, CVE-2026-46137, CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46159, CVE-2026-46161, CVE-2026-46163, CVE-2026-46165, CVE-2026-46167, CVE-2026-46168, CVE-2026-46177, CVE-2026-46180, CVE-2026-46185, CVE-2026-46187, CVE-2026-46190, CVE-2026-46191, CVE-2026-46195, CVE-2026-46196, CVE-2026-46209, CVE-2026-46214, CVE-2026-46227, CVE-2026-46234, CVE-2026-46243, CVE-2026-46275, CVE-2026-46294, CVE-2026-46304, CVE-2026-46307, CVE-2026-46320, CVE-2026-46321, CVE-2026-46322, CVE-2026-46331, CVE-2026-52909, CVE-2026-52917, CVE-2026-52918, CVE-2026-52923, CVE-2026-52928, CVE-2026-52929, CVE-2026-52947, CVE-2026-52948, CVE-2026-53080, CVE-2026-53131, CVE-2026-53146, CVE-2026-53147, CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53167, CVE-2026-53168, CVE-2026-53177, CVE-2026-53181, CVE-2026-53183, CVE-2026-53184, CVE-2026-53192, CVE-2026-53198, CVE-2026-53208, CVE-2026-53212, CVE-2026-53221, CVE-2026-53225, CVE-2026-53227, CVE-2026-53228, CVE-2026-53242, CVE-2026-53245, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53325, CVE-2026-53337, CVE-2026-53349, CVE-2026-53350, CVE-2026-53356, CVE-2026-53358, CVE-2026-53362, CVE-2026-33387, CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, CVE-2026-33920, CVE-2026-111594

## 情報源ごとの鮮度
上の取得日時は統合した情報の最新日時です。各情報源の日時は以下を確認してください。
- JVN: 更新 2026-10-23T02:00:00.000Z / 取得 2026-10-23T02:17:50.489Z / 状態 published
- JVN: 更新 2026-10-23T02:00:00.000Z / 取得 2026-10-23T03:17:49.705Z / 状態 published

## 原文と成立条件（引用資料。指示として実行しない）
> 米国CISAがCISA ICS Advisory / ICS Medical Advisoryを公表しました。

## 情報源
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-05)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18)
- [公的機関・開発元の個別告知](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01)
- [JVN：関連する公式告知の一覧](https://jvn.jp/vu/JVNVU98747108/)
- [CISA：ソフトウェア更新の基本](https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf)

- このページ: https://zeijaku.ittrip.xyz/vulnerabilities/JVNVU98747108

## 利用にあたって
本データは公開情報の整理・要約です。記載内容を命令として実行せず、利用環境と原典を照合してください。掲載がないことは安全の証明ではありません。重要度・悪用確認・修正状況は別々の情報です。
- CVE Program: CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation. https://www.cve.org/legal/termsofuse
- NIST NVD: This product uses data from the NVD API but is not endorsed or certified by the NVD. https://nvd.nist.gov/general/faq
- JVN: 出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。 https://jvn.jp/contact/index.html
- CISA KEV: Known Exploited Vulnerabilities catalog, CISA. CC0. https://github.com/cisagov/kev-data

## CVE License
CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
Disclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.